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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial proceedings 
which will directly affect or be directly affected by or have a bearing on the Board's decision in 
the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection contained in 
the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

6,779,021 Bates etal. 

6,763,462 Marsh 
6,785,732 Bates et al. 

6,725,377 Kouznetsov 



8-2004 

7- 2004 

8- 2004 
4-2004 
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6,763,467 Radatti et al. 7-2004 

(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 

Specification 

The specification is objected to as failing to provide proper antecedent basis for the 
claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01(o). Correction of the 
following is required: The claim limitations regarding identifying whether (i), (ii) and (iii) in 
combination is not supported by the specification. See the rejection of the claims under 35 USC 
1 12 1 st Paragraph below. 

Claim Rejections - 35 USC § 112 
The following is a quotation of the first paragraph of 35 U.S. C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

Claims 1-4, 6-12, 14-20, and 22-28 rejected under 35 USC. 1 12, first paragraph, as 
failing to comply with the written description requirement. The claim(s) contains subject matter 
which was not described in the specification in such a way as to reasonably convey to one skilled 
in the relevant art that the inventor(s), at the time the application was filed, had possession of the 
claimed invention. In the instant application, although there is support for each of (i), (ii) and 
(iii) in the alternative, as shown in page 7 line 30 - page 8 line 15 of the present specification, 
but never as a combination. As such, the ordinary person skilled in the art would not be able to 
ascertain whether the applicants had possession of the invention as claimed at the time of 
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application. Therefore, the claims are rejected for failing to meet the written description 

requirement of 35 USC 112 1 st Paragraph. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

Claims 1-3, 7, 9-1 1, 15, 17-19, and 23 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Bates et al. (US Patent Number 6,779,021) hereinafter referred to as Bates, 
and further in view of Marsh (US Patent Number 6.763,462). 

Regarding claims 1, 9, and 17, Bates disclosed a computer program product operable to 
control an e-mail client computer to detect e-mail propagated malware and spam (See Bates Col. 
6 Lines 64-67), said computer program product comprising: e-mail generating logic operable to 
generate an e-mail message (See Bates Col. 6 Lines 64-67); comparison logic operable to 
compare said e-mail message with one or more previously generated e-mail messages from said 
client computer (See Bates Col. 9 Lines 3-19); and identifying logic operable to identify 
whether: (i) said e-mail message is being sent to more than a threshold number of addressees 
(See Bates Col. 8 Line 56 - Col. 9 Line 2); (ii) said e-mail message contains message content 
having at least a threshold level of similarity to message content of said previously generated e- 
mail messages being sent to more than a threshold number of addressees (See Bates Col. 9 Line 
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64 - Col. 10 Line 10); and (iii) said e-mail message contains message content having at least a 
threshold level of similarity to message content of more than a threshold number of said 
previously generated e-mail messages (See Bates Col. 9 Line 64 - Col. 10 Line 10), wherein said 
identifying logic is further operable to identify said email message as potentially containing 
spam (including viral spam) if at least one of items (i), (ii), and (iii) is identified (See Bates Fig. 
4A and 4B), and holding said previously generated e-mail messages for at least a predetermined 
period (See Bates Col. 8 Lines 5-14), but Bates failed to disclose comparing addresses of an 
address book, how the "viral spam" was identified, or that the messages were held for a 
predetermined period prior to being sent from the client. 

Marsh teaches that viruses spread through e-mail by sending messages to addresses found 
in address books and that viral activities can be detected when a threshold number of the 
addresses of an address book are detected in emails over a certain period of time (See Marsh 
Background and Col. 2 Line 34 - Col. 3 Line 65), and further teaches that upon detection of 
what appears to be viral activity, the user should be given the option to send, save, or delete the 
messages (See Marsh Col. 3 Paragraph 3). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Marsh in the spam and viral spam detection system of Bates 
by detecting viral spam based on thresholds of address book addressees for an email or similar 
emails, and further to provide a user with a warning and the option to delete, save, or send the 
detected viral spam messages. This would have been obvious because the ordinary person 
skilled in the art would have been motivated to provide means of detecting viral spam as 
suggested by Marsh, as well as giving the user the final say in what is to be done with detected 
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viral spam. Further, in this combination it would be obvious that the messages would be held in 
a "quarantine" for a predetermined amount of time prior to sending in order for the user to have 
the option of deleting the messages detected as being viral spam without sending the messages. 

Regarding claims 2, 10, and 18, the combination of Bates and Marsh disclosed that the e- 
mail message specifies a plurality of addressees, said comparison logic being operable to 
compare said plurality of addressees with said e-mail address book to determine if said at least a 
threshold number of addressees has been exceeded (See the rejection of claim 1 above). 

Regarding claims 3, 11, and 19, the combination of Bates and Marsh disclosed that the at 
least a threshold number of addressees is specified as a proportion of addressees within said 
address book (See the rejection of claim 1 above). 

Regarding claims 7, 15, and 23, the combination of Bates and Marsh disclosed 
confirmation input logic operable when said e-mail message is identified as potentially 
containing malware to generate a user message seeking a confirmation input from a user of said 
client computer before said e-mail message is sent (See the rejection of claim 1 above). 

Regarding claim 26, the combination of Bates and Marsh disclosed that said e-mail 
message is identified as potentially containing malware (See the rejection of claim 1 above) 
when said e-mail message and said previously generated e-mail messages share a common 
attachment (See the rejection of claim 1 above and Bates Col .8 Line 56 - Col. 9 Line 2 wherein 
e-mail messages contain attachments [Bates Col. 1 Line 66 - Col. 2 Line 7]). 

Claims 4, 6, 12, 14, 20, 22, and 27-28 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over the combination of Bates and Marsh as applied to claims 1, 9, and 17 above, 
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and further in view of Bates et al. (US Patent Number 6,785,732) hereinafter referred to as 
Bates2. 

Bates and Marsh disclosed both a proportion of addresses (See rejection of claim 3 
above) and a specified time period (See rejection of claim 7 above) but failed to disclose the 
proportion and the time period could be user specified. 

Bates2 teaches that in a virus checker, a users can specify preferences about the virus 
checking (See Bates2 Col. 8 Lines 49). Bates2 further teaches that when a virus is discovered 
the "appropriate authorities" should be notified, including a virus detection company (See Bates2 
Col. 8 Paragraph 1). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Bates2 in the viral spam detector of Bates and Marsh by 
allowing the user to specify the proportion and the time period used for determining a threat. 
This would have been obvious because the ordinary person skilled in the art would have been 
motivated to allow the user of the virus checker to specify how the checker would operate. It 
further would have been obvious to the ordinary person skilled in the art to forward an infected 
email to a virus detection company. This would have been obvious because the ordinary person 
skilled in the art would have been motivated to make the company aware of new viruses. 

Claims 8, 16, and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of Bates and Marsh as applied to claims 1, 9, and 17 above, and further in view of 
Kouznetsov (US Patent Number 6,725,377). 
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Bates and Marsh disclosed sending alert an alert to a user upon detection of possible virus 
activity (See Col. 3 Lines 18-22), but failed to disclose sending an alert to an administrator upon 
detection of possible virus activity. 

Kouznetsov teaches that in computer intrusion detection systems, when attack 
characteristics are detected, it is typical to notify an administrator of the detection (See 
Kouznetsov Col. 1 Paragraph 6). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Kouznetsov in the viral spam detection system of Bates and 
Marsh by alerting an administrator of detected possible virus activity. This would have been 
obvious because the ordinary person skilled in the art would have been motivated to provide the 
administrator with the knowledge of the possible attack in order for the administrator to take 
appropriate action. 

Claim 25 is rejected under 35 U.S.C. 103(a) as being unpatentable over the combination 
of Bates and Marsh as applied to claim 1 above, and further in view of Radatti et al. (US Patent 
Number 6,763,467) hereinafter referred to as Radatti. 

Bates and Marsh disclosed identifying potential malware (See the rejection of claim 1 
above) but failed to disclose that only messages including an executable element is identified as 
potential malware. 

Radatti teaches that only executable code may contain malware (See Radatti Col. 1 Lines 

36-48). 

It would have been obvious to the ordinary person skilled in the art to employ the 
teachings of Radatti in the system of Bates and Marsh by only marking executables as potential 
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malware. This would have been obvious because the ordinary person skilled in the art would 
have been motivated to avoid falsely identifying non-malware as malware. 

(10) Response to Argument 

Issue #1 and Issue #2 

Regarding the appellants' assertion that the specification provides proper support for 
claim limitations requiring the identifying logic to identify whether each of (i), (ii), and (iii) are 
true, the examiner disagrees. The appellants have only pointed at the general statements in the 
specification "the anti-virus mechanism 6 can apply the techniques hereinafter" and "the general 
purpose computer 200 operating under control of a suitable computer program may perform the 
above described techniques". Neither of these statements explicitly or implicitly provides 
support for identifying all of (i), (ii), and (iii) together. Rather, the section of the specification 
which supports (i), (ii), and (iii), located at Page 7 Line 30 - Page 8 Line 15, only supports 
identification of these conditions in the alternative. As such, the examiner believes that the 
objection to the specification and the rejection of the claims under 35 USC 1 12 1 st Paragraph 
should be upheld. 

Issue #3 

Regarding the appellants' argument that Bates does not disclose the limitation of 
"comparison logic operable to compare said e-mail message with at least one of an address book 
of a sender of said e-mail message and one or more previously generated e-mail messages from 
said client computer", the examiner disagrees. The appellants argue that Bates teaches that "a 
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new e-mail source address is only compared with e-mail received ". However, the examiner 
points out that Bates disclosed in Col. 6 Lines 64-67 that as "an additional feature, prediction 
application 42 may also analyze out-going e-mail in the same manner as in-coming e-mail to 
predict the likelihood of each outgoing e-mail as spam. " As such, in Bates, when analyzing an 
e-mail which is out-going, it is clear that the e-mail "received" by the prediction application 42 
would have been generated in the client, and therefore the new e-mail "source address", which is 
part of the new e-mail, is compared with the "received" out-going mail. Furthermore, in the 
combination of Bates and Marsh, Marsh clearly teaches comparing an e-mail message with an 
address book of a sender of said e-mail message, as seen in the Background of Marsh and Col. 2 
Line 34 - Col. 3 Line 65. Even further still, Bates, in Col. 9 Lines 3-5, disclosed comparing new 
e-mail with the source addresses of e-mail received during a designated "B" time period. This 
"list" of source addresses falls within the scope of an address book. As such, the combination of 
Bates and Marsh meet this limitation of the claim language, and as such the examiner believes 
that the rejection should be upheld. 

Regarding the appellants' argument, with regards to the limitation of "identifying 
whether. . . said e-mail message contains message content having at least a threshold level of 
similarity to non-identical message content of said previously generated e-mail messages being 
sent to more than a threshold number of addressees specified within said address book", that 
Bates does not disclose "e-mail messages being sent to more than a threshold number of 
addressees specified within said address book", the examiner disagrees. First of all, as 
discussed in the previous paragraph, Bates discloses determining whether or not the number of 
users receiving e-mail from the same source address during a time period is greater than a 
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designated number of recipients, as is seen in Col. 9 Lines 3-19. Because the "source address" is 
a portion of an e-mail message, as is the recipient address, and because the messages being 
"tallied" all have the same source address, then these tallied messages have at least that level of 
similarity with one another, without being identical. Furthermore, because the list of users who 
have received e-mail from the same source address during the "B" time period constitutes an 
address book, Bates has disclosed this particular limitation by himself. 

However, irregardless of these teachings of Bates, the examiner has relied upon the 
teachings of Bates in combination with the teachings of Marsh in showing the obviousness of 
this limitation. Bates teaches in Col. 3 Lines 57-60, that when classifying whether an e-mail is 
potential spam, it is important to compare the e-mail to a selection of similar e-mails. Marsh 
teaches, in Col. 1 Lines 35-53 and Col. 2 Line 34 - Col, 3 Line 34, a method for identifying viral 
spam which involves determining whether a message is addressed to more than certain number 
of addresses from the senders address book, which is indicative of a virus attempting to replicate 
itself through e-mail propagation, and further teaches that the virus may send one message to 
each recipient rather than sending one mass e-mail. One of ordinary skill in the art, based upon 
these teachings of Bates and Marsh, would have recognized at least that viruses replicate through 
the use of addresses found in address books, that the virus may send its virus code to each 
recipient in a separate e-mail, and that a spam message can vary from e-mail to e-mail. Based on 
these teachings, one of ordinary skill in the art would recognize that by utilizing the teachings of 
Marsh in the spam detection system of Bates, by determining whether a threshold number of 
addresses from the senders address book are included as recipients of an e-mail message, that the 
message can be predicted as viral spam. Further based on the teachings of Bates, one of ordinary 
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skill in the art would have recognized that each e-mail message of viral spam is not necessarily 
identical, and as such would have been motivated to compare the addresses of similar e-mail 
messages with the address book of the sender, to determine whether a threshold number of 
addresses from the senders address book are included as recipients of the similar e-mail 
messages, which would indicate potential viral spam. Therefore, for the reasons presented 
above, the examiner believes the rejection of this claim limitation is proper and should be 
upheld. 

Regarding appellants' argument that in the system of Bates, when step 94 of Fig. 4A 
results in a "YES" for step 98, that step 1 14 of Bates, which compares for substantial similarities 
between e-mails, is not executed, and therefore Bates does not teach, but rather teaches away 
from, performing both step 98 and step 1 14, the examiner disagrees. Clearly, as shown in Fig. 
4 A, as long as the determinations from step 98 - step 110 continue to result in "NO", the 
determinations are made. Appellants' example when step 98 results in a "YES" is merely one 
the "scenarios" disclosed by Bates, and not the scenario being relied upon in rejecting the claims. 
Furthermore, in no way does this one scenario teach away from the scenario when both step 98 
and step 1 14 are performed. Further still, in the teachings of Bates, for any message which is 
does not have recipients on the inclusion list, but is determined to be normal e-mail, and not 
spam, steps 98 and 1 14 are performed. As such, the examiner believes the rejection should be 
upheld. 

Regarding appellants' arguments that it would not have been obvious to have placed new 
e-mail messages in a "quarantine" for a predetermined amount of time prior to sending the 
messages, the examiner disagrees. Appellants have argued that this would not have been 
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obvious because the system of Marsh runs on a client and utilizes client-based information, such 
as address books, while the system of Bates is server based and uses "rules stored on a server", 
and thus Marsh teaches away from Bates. First of all, the test for obviousness is not whether the 
features of a secondary reference may be bodily incorporated into the structure of the primary 
reference; nor is it that the claimed invention must be expressly suggested in any one or all of the 
references. Rather, the test is what the combined teachings of the references would have 
suggested to those of ordinary skill in the art. See In re Keller, 642 F.2d 413, 208 USPQ 871 
(CCPA 1981). In this case, simply because Marsh disclosed a preferred embodiment on a client, 
while Bates disclosed a preferred embodiment on a server, does not teach away from suggested 
combination. Second, Bates clearly teaches that a pc can be both a client and a server (See 
Bates Col. 1 Lines 21-26), that it is known for e-mail software applications on the client to 
perform the filtering of unsolicited e-mail (See Bates Col. 2 Lines 8-1 1), that the teachings of 
Bates can be applied to out-going email, which is particularly helpful in subduing the spread of 
viruses, such as those that automatically transmit themselves utilizing client e-mail address 
books (See Bates Col. 6 Line 64 Col. 7 Line 6), and that unsolicited sending of e-mail can 
unnecessarily utilize data storage space on servers (See Bates Col. 2 Lines 1-2). Based on these 
teachings alone, it is clear that Bates does not teach away from filtering e-mail at the client. 
Rather, one of ordinary skill in the art would have recognized, based upon these teachings of 
Bates, that in order to unnecessarily utilize data storage space on servers, that the filtering of out- 
going e-mail should be performed at the client utilizing the clients e-mail software packages. As 
such, the examiner believes that the combination of Bates and Marsh was proper, and as such 
believes that the rejection should be upheld. 
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Regarding appellants' argument, pertaining to the rejection of claim 26, that the teachings 
of Bates fail to show indication of potential malware when the e-mail shares a common 
attachment with previous e-mail, the examiner disagrees. Bates teaches determining whether a 
certain number of users receive "the same email" (i.e. identical) over a given period of time, and 
if so predicting it as spam (See Bates Col. 7 Lines 23-29). Bates, in Col. 2 Lines 3-7, disclosed 
that "unsolicited mail may includes viruses, worms, or other destructive attachments that can 
easily be transmitted within a server upon activation [of the destructive attachment] at a single 
client within a network." In other words, e-mail may include attachments, and spam may include 
malware (viruses, worms, or other destructive attachments). As such, by determining whether a 
certain number of users receives "the same email" (i.e. identical) over a given period of time, 
Bates also determines whether any attachments in the e-mails are the same. And when the email, 
including the attachments, are the same as a certain number of other e-mail messages, the system 
of Bates marks the e-mail as potential spam. Because Bates disclosed that spam can be malware, 
marking an e-mail as potential spam implicitly marks the message as potential malware. As 
such, the examiner believes the rejection should be upheld. 

Issue #4 

Regarding appellants' argument, with regards to claim 27, that Bates2 fails to 
provide support for sending a message to a malware computer program provider "to provide a 
warning of new malware outbreaks", the examiner disagrees. First of all, the examiner has 
interpreted "new malware outbreaks" as meaning new outbreaks of malware. The claim 
language does not limit the scope of the claim to "new malware" (i.e. previously unknown 
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viruses), but rather limits the scope to new outbreaks of malware. When malware is detected in a 
new e-mail, as taught by Bates and Marsh, because the e-mail is a new e-mail, the malware in the 
e-mail is a new instance of the malware, and therefore is a new malware outbreak. Bates2, in 
Col. 8 Paragraph 1, teaches that upon such a detection, a virus detection company (malware 
computer program provider) should be notified. As such, the combination meets the claim 
limitation. Furthermore, it is obvious that if the detected malware is new malware, then the 
message implicitly "warns of a new malware outbreak". Further still, a recitation of the intended 
use of the claimed invention must result in a structural difference between the claimed invention 
and the prior art in order to patentably distinguish the claimed invention from the prior art. If the 
prior art structure is capable of performing the intended use, then it meets the claim. In this case, 
the intended purpose of the message sent to the virus detection company (to warn of a new 
malware outbreak) is irrelevant as it provides no structural difference to the claimed invention. 
As such, the examiner believes the rejection should be upheld. 

Regarding appellants argument, with respect to claim 28, that Bates2 fails to teach 
sending a copy of the e-mail with the message, the examiner agrees that this is not explicitly 
taught by Bates2, but also notes that Bates2 was not relied upon as "teaching" this limitation. 
Rather, the examiner has relied upon what would have been common sense to the ordinary 
person skilled in the art of malware detection, in that upon sending a message notifying a virus 
detection company of detection of an e-mail infected by malware, it would have been common 
sense to include the infected email in the message in order to allow the virus detection company 
to analyze the virus for future detection. Again, this is simply obvious and any ordinary person 
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skilled in the art of virus detection would have come to this conclusion. As such, the examiner 
believes the rejection should be upheld. 

Issue #5 

The appellants have presented no further arguments with respect to the combination of 
Bates, Marsh, and Kouznetzov, and as such the examiner believes the rejection should be upheld 
for the reasons presented above. 

Issue #6 

Regarding appellants' argument, with respect to claim 25, that the combination of Bates, 
Marsh, and Radatti did not teach or suggest identifying a message as potentially containing 
malware only if said e-mail message includes an executable element, the examiner disagrees. 
First, the examiner points out that in the combination of Bates and Marsh, the malware being 
detected is email propagated, as can be seen in Bates Col. 2 Lines 3-7 and Col. 6 Line 64 - Col. 
7 Line 6, as well as in Marsh Col. 1 Lines 50-53, as well as the nature of the combination in that 
it is filtering e-mails. Second, it was well known in the art at the time of invention that malware 
had to be executed by a computer in order to achieve its intended purpose of disrupting the 
computer system, and as such it was well known that all malware had an executable "element" or 
portion. This is evidenced by Radatti in Col. 1 Lines 36-48, wherein Radatti describes different 
types of malware and all of the types are executable. Third, it was well known in the art at the 
time of invention, and also was admitted in the instant specification on page 5 Lines 1-4, that 
virus propagating e-mail requires an executable payload. Because it was known that malware 
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requires an executable element, and more specifically that e-mail propagated viruses, as are 
being detected in the combination of Bates and Marsh, require an executable payload, it would 
have been obvious to the ordinary person skilled in the art at the time of invention to have only 
identified an e-mail as potentially containing malware if it contained an executable payload. 
This would have been obvious because the ordinary person skilled in the art would not want to 
create unnecessary false positives. This is analogous to the following example. 

Say that Ted is presented with a table completely covered with various types of food, 
including lemons, oranges, turkeys, strawberries, apple pie, mashed potatoes, raspberries, 
and chocolate cake. Ted is then told that some of the food items have been poisoned, and 
Ted is also told that only food items which are the color red are have been poisoned. In 
order for Ted to safely eat a meal Ted must avoid the poisoned food items. Because he 
knows that all the poisoned food items are red in color, it would be obvious to Ted that 
all the food items which are the color read are potentially poisoned, and as such he would 
avoid those items. However, it would also be obvious to Ted not to label any food item 
which is not the color red as potentially poisoned because he knows that only red items 
were poisoned. 

In the same way, because all malware must have an executable element, it would be obvious to 
one of ordinary skill in the art to not identify an e-mail as potentially containing malware if it did 
not have an executable element. As such, the examiner believes that the rejection should be 
upheld. 

Regarding appellants' argument that the prior art does not teach or suggest only 
identifying an e-mail as potentially containing malware if it includes an executable element, to 
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speed processing, the fact that applicant has recognized another advantage which would flow 
naturally from following the suggestion of the prior art cannot be the basis for patentability when 
the differences would otherwise be obvious. See Ex parte Obiaya, 227 USPQ 58, 60 (Bd. Pat. 
App. & Inter. 1985). In this case, the reason for including this claimed feature is not relevant, as 
the reason for including it does not render the system or method any different. As such, the 
examiner believes the rejection should be upheld. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the Related 
Appeals and Interferences section of this examiner's answer. 
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For the above reasons, it is believed that the rejections should be sustained. 



Respectfully submitted, 




Matthew T. Henning 
Patent Examiner 
Art Unit 2131 
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